HIDDEN COBRA deploys ECCENTRICBANDWAGON keylogger RAT
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
North Korean-attributed ECCENTRICBANDWAGON RAT performs keylogging and screenshots; multiple variants use temp folders and thread-based data exfiltration.
CISA, FBI, and DoD analysis identifies ECCENTRICBANDWAGON, a remote access tool attributed to North Korean HIDDEN COBRA actors. The malware family functions as a reconnaissance platform, deployed via proxy servers to maintain persistent access on victim networks. Four analyzed variants are 64-bit DLLs that create three threads to simultaneously perform keylogging, screen capture, and activity logging. Logged data is written to disguised temp directories using names like "GoogleChrome" and "TrendMicroUpdate" to evade detection. Some variants implement RC4 encryption for embedded strings and cleanup routines; one variant forcibly terminates explorer.exe during shutdown, potentially alerting users. The malware responds only to an exported "Process" function call to cease logging and exit, suggesting control via legitimate host processes or injected code. No active CVE exploitation is documented; the threat relies on initial compromise via separate means.
Mentioned in this report
Detection guidance
File Written to Temp Directory Masquerading as Chrome or Trend Micro Update
Files created in Temp subfolders named GoogleChrome or TrendMicroUpdate, the disguised log directories used by ECCENTRICBANDWAGON keylogger and screen-capture data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: File Written to Temp Directory Masquerading as Chrome or Trend Micro Update
description: Detects file creation inside a Temp subfolder named after a legitimate
vendor product (GoogleChrome, TrendMicroUpdate). ECCENTRICBANDWAGON stores keylog
and screenshot data in such disguised directories. Legitimate Chrome and Trend Micro
components do not normally write to these Temp paths.
tags:
- attack.stealth
- attack.t1036.005
- attack.collection
- attack.t1056.001
- attack.t1113
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \Temp\GoogleChrome\
- \Temp\TrendMicroUpdate\
condition: selection
falsepositives:
- Third-party software that legitimately creates a similarly named staging folder
under Temp
level: medium
id: 8ada36c1-5343-5907-9861-013b5a46ddf2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239a
Rundll32 Invoking Exported Process Function from User-Writable Path
rundll32 calling an export named Process on a DLL located in a user-writable path, matching the control interface of the ECCENTRICBANDWAGON DLL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rundll32 Invoking Exported Process Function from User-Writable Path
description: Detects rundll32.exe executing an export literally named Process from
a DLL in a user-writable location (Temp, AppData, ProgramData, Public). The ECCENTRICBANDWAGON
64-bit DLL only stops logging via an exported Process function, implying it is driven
by a host process or loader.
tags:
- attack.stealth
- attack.t1140
- attack.collection
- attack.t1056.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \rundll32.exe
selection_export:
CommandLine|endswith:
- ',Process'
- ',Process"'
- ', Process'
selection_path:
CommandLine|contains:
- \Temp\
- \AppData\
- \ProgramData\
- \Users\Public\
condition: selection_img and selection_export and selection_path
falsepositives:
- Custom in-house DLLs that happen to export a function named Process and are run
via rundll32 from AppData
level: medium
id: dcc3d9b4-b2e4-5731-a1ed-d8eb1029ecf6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239a
Forced Termination of explorer.exe via Taskkill
taskkill forcibly ending explorer.exe, behaviour similar to the ECCENTRICBANDWAGON variant that kills explorer during shutdown. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Forced Termination of explorer.exe via Taskkill
description: Detects taskkill.exe forcibly terminating explorer.exe. One ECCENTRICBANDWAGON
variant kills explorer.exe during its shutdown routine; command-line based kills
are a related observable. Needs context since admins and scripts also restart the
shell.
tags:
- attack.collection
- attack.t1056.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \taskkill.exe
CommandLine|contains|all|windash:
- -f
- explorer.exe
condition: selection
falsepositives:
- Administrators or helpdesk scripts restarting the Windows shell to apply UI or policy
changes
- Software installers that restart explorer.exe
level: low
id: 7a58bf25-3787-5007-bf54-df5bf44e961e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-239a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs